#!/etc/rc.d/init.d/firehol
#
# THREE RULESETS: dst-publicip, dst-privateip, dst-world
#
FIREHOL_LOG_MODE="ULOG"
#FIREHOL_LOG_OPTIONS=" --log-tcp-options --log-ip-options"
#FIREHOL_ULOG_OPTIONS=" --log-tcp-options --log-ip-options --ulog-cprange 0 "
#FIREHOL_LOG_OPTIONS="--log-level info --log-tcp-options --log-ip-options -ll"
FIREHOL_LOG_OPTIONS="--ulog-cprange 0"
interface eth0 dst-publicip dst 206.222.12.74/32
# The default policy is DROP. You can be more polite with REJECT.
# Prefer to be polite on your own clients to prevent timeouts.
policy drop
# If you don't trust the clients
# add something like this.
# protection strong
# Here are the services listening on eth0.
server smtp accept
server ICMP accept
#server mysql accept
server ntp accept
server webmin accept
server http accept
server dns accept
server ssh accept
server pop3 accept
server imaps accept
server https accept
server all accept
client smtp accept
client dns accept
client ICMP accept
client ssh accept
client pop3 accept
client http accept
client imaps accept
client https accept
client ntp accept
client all accept
interface eth1 dst-privateip dst 192.168.1.3/32
# The default policy is DROP. You can be more polite with REJECT.
# Prefer to be polite on your own clients to prevent timeouts.
#policy drop
policy reject
# If you don't trust the clients behind eth1 (net "192.168.1.0/24"),
# add something like this.
# > protection strong
# Here are the services listening on eth1.
# TODO: Normally, you will have to remove those not needed.
server ICMP accept
#server mysql accept
server ntp accept
server smtp accept
server webmin accept
server http accept
server dns accept
server ssh accept
server https accept
server all accept
client dns accept
client ICMP accept
client smtp accept
client ssh accept
client https accept
client all accept
interface eth0 dst-outside dst not "192.168.1.3 206.222.12.74"
# The default policy is DROP. You can be more polite with REJECT.
# Prefer to be polite on your own clients to prevent timeouts.
policy drop
#policy reject
# If you don't trust the clients behind eth1 (net "192.168.1.0/24"),
# add something like this.
# > protection strong
# Here are the services listening on eth1.
# TODO: Normally, you will have to remove those not needed.
server ICMP accept
#server mysql accept
server ntp accept
server smtp accept
server webmin accept
server http accept
server dns accept
server ssh accept
server https accept
server imaps accept
server all accept
client ICMP accept
client dns accept
client smtp accept
client ssh accept
client https accept
client http accept
client imaps accept
client all accept
# for now, we let all traffic out